TIBBS authorization

Privacy policy

Effective and last updated: 14 October 2026

This policy describes how the TIBBS platform handles information for third-party sign-in, identity linking and the shared authorization service at oauth.tibbs.app. Merchant commerce, partnership and other optional features may have additional privacy notices in their respective portals. Contact TIBBS at [email protected].

Information we process

• Third-party identity: the identity provider and account identifier, email address and its verification status, display name, and profile image URL when supplied. Google sign-in requests the OpenID Connect scopes openid, email and profile.
• Account and portal context: the TIBBS account or merchant partner account being accessed, merchant portal, invitation context, and the account-linking choice you make.
• Sign-in and security information: temporary authorization codes and identity tokens needed to verify sign-in, transaction and session identifiers, necessary browser cookies or local session storage, and technical request information such as IP address, browser information and error/security events.

Google sign-in does not request access to your Gmail messages, Drive documents, contacts or calendars. We do not receive your Google password. Other TIBBS integrations requesting additional permissions must describe those permissions separately.

Why we use it

We use this information to verify your identity, create or access an eligible account, link an identity after the required account proof, maintain your session, return you to the originating portal, prevent account takeover and misuse, and investigate sign-in or privacy requests. Where applicable, processing is necessary to provide the service you request, protect the service through legitimate security interests, or meet legal obligations. Optional provider access is based on the authorization you grant and can be revoked.

Who receives it

The identity provider receives the authorization request and the information needed to complete its own sign-in process. TIBBS processes the resulting identity for the originating service. A participating merchant receives information associated with your partner account and relationship in its own portal; this sign-in does not authorize access to your accounts with other merchants.

Infrastructure and service providers supporting hosting, delivery and security may process necessary information to operate TIBBS. Authorized personnel may access information to resolve support or security incidents. We may disclose information when required by law or to protect users and the service. Service infrastructure or providers may process data outside your country; applicable data-protection requirements apply.

We do not sell Google sign-in data, use it for advertising, or use it to train generalized AI models. TIBBS use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements where applicable.

Storage, security and retention

HTTPS protects the authorization flow. Provider credentials are encrypted in the platform credential store. Authorization transactions and session material are used for their sign-in or session purpose. Linked identity records remain associated with the relevant account until unlinked or deleted, subject to any necessary legal or security retention. We retain account and security information only as needed for the stated purposes and applicable obligations; this policy does not promise a fixed retention period for every category. No online service can guarantee absolute security.

Your choices and requests

You can cancel third-party authorization, use another available sign-in method, and revoke TIBBS access in your identity provider’s account settings. Provider revocation and deleting a TIBBS account are separate actions. Where an account provides an unlink option, removing a sign-in identity may require another verified sign-in method so you are not locked out.

To request access, correction, deletion, portability, restriction or objection where applicable, email [email protected], identify the affected portal and account, and describe your request. We may ask for proof of account ownership. Do not send passwords or authorization codes. We will explain any information that must be retained and the reason. You may also contact your local data-protection authority where applicable.

Cookies and local storage

The sign-in flow uses necessary browser storage to keep sessions, bind an authorization transaction to the browser and complete the return to the merchant portal. Blocking this storage can prevent sign-in. These policy pages do not include advertising or analytics scripts.

Changes

We update this page when the authorization service or its data handling changes and revise the date above. Material changes requiring notice or a new authorization will be communicated through the affected service.